[libbeat] The output.events.active metric can be negative

[HugoKuo]

For confirmed bugs, please report:

• Version: filebeat.x86_64 7.10.2-1 @/filebeat-oss-7.10.2-x86_64LtGs8_
• Operating System: CentOS Linux release 7.9.2009 (Core)
• Discuss Forum URL: https://discuss.elastic.co/t/how-to-read-the-monitoring-log-of-filebeat/305721
• Steps to Reproduce: Running filebeat in the frontground. There're a thoudsand nodes sending logs to elasticsearch.out 6 hosts.

The active -1140 is kind confusing.
"output":{"events":{"acked":9332,"active":-1140,"batches":8,"total":8192}

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[cmacknz]

We have seen this before but never found the root cause. Possibly the same problem as in #31582 not the same problem this metric is already a gauge.

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!